Forced Consent (DPAs in Austria, Belgium, France, Germany and Ireland)
When relying on consent as a legal basis to process personal data, companies need to comply with the stringent requirements contained in the GDPR. In May 2018, noyb filed four complaints; in France against Google, in Austria against Facebook, in Belgium against Instagram and in Germany against Whatsapp. The reason for this was that these major companies adopted a “take it or leave it” approach, forcing their users to consent to both their privacy policies and terms in full, in order to keep using their services.
In January 2019, following our complaint the French supervisory authority (CNIL) imposed a 50 million euro fine on Google over the company’s invalid consent mechanisms. The sanction was appealed and a hearing date before the French Conseil d’Etat is yet to be set. All three other complaints (Facebook, Instagram and WhatsApp) triggered the European cooperation mechanism and are still being investigated today. We are carefully monitoring the cooperation between the Irish DPC and its counterparts and are hoping to hear back from our latest submissions in the near future.