Forced Consent & Consent Bypass

Forced Consent & Consent Bypass
The GDPR generally prohibits the processing of other’s data, unless a company can demonstrate that at least one of six exceptions applies. For advertising this is typically consent of the user, as other options are not applicable.

Under the GDPR, consent must satisfy different requirements to be legally binding: it must be freely given, specific, informed, and unambiguous. Furthermore, under Article 7 GDPR, consent must be requested in a transparent and fair way and should be withdraw-able at any time – so basically you need an informed “yes/no” or “opt-in” consent. This leads to significantly less people giving consent, so many companies try to bypass it.

The market power of major corporations has allowed them to force their customers to consent to almost any form of data processing, by only giving them one chance: either accept everything or don’t use this service anymore. We take action against such approaches.

In this project, noyb

  • filed four complaints against Google, Facebook, Instagram and Whatsapp on May 25th 2018, because they were forcing their users to consent to both their privacy policies and terms in full, in order to keep using their services
  • we won against all players before the French CNIL and the European Data Protection Authority and now ensure that these rulings are upheld and enforced.

ATTENTION: These cases predate noyb's complaint management system and are not fully documented in the system
Case Controller DPA Status Duration
C001 Google Ireland Limited DPC (Ireland), CNIL (France) Partial Decision Filed:
(6 years 7 months ago)
C002 Meta Ireland Limited DSB (Austria), DPC (Ireland) Pending (4 years and more) Filed:
(6 years 7 months ago)
C003 Instagram DPC (Ireland), APD/GBA (Belgium) Partial Decision Filed:
(6 years 7 months ago)
C004 WhatsApp Ireland Limited DPC (Ireland), BfDI (Germany) Pending (4 years and more) Filed:
(6 years 7 months ago)
C058 Profil Redaktion GmbH DSB (Austria) Pending (2 - 3 years) Filed:
(2 years 2 months ago)
C075 Meta Ireland Limited DSB (Austria), DPC (Ireland) Pending (12 - 18 months) Filed:
(1 year 1 month ago)
C076 Meta Ireland Limited DPC (Ireland), DSB (Austria) Pending (6 - 12 months) Filed:
(11 months 2 weeks ago)
C080 k-digital Medien GmbH & Co KG DSB (Austria) Pending (6 - 12 months) Filed:
(6 months 3 weeks ago)
C083 Google LLC DSB (Austria) Pending (6 - 12 months) Filed:
(6 months 2 weeks ago)
C091 BeReal CNIL (France) Pending (0 - 6 months) Filed:
(2 weeks 3 days ago)