Deceptive Patterns
‹ All rules EU & UK

GDPR - Article 04(11)

Jurisdiction
EU & UK
Law
GDPR (EU)
Date
14 May 2018

Consent is a voluntary agreement by an individual for their personal data processing, after being informed of its specific purposes and conditions.

Excerpt from regulation

“‘consent’ of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her” - GDPR Article 4, paragraph 11

View full legislation

Related deceptive patterns

Sneaking ›The user is drawn into a transaction on false pretences, because pertinent information is hidden or delayed from being presented to them. Preselection ›The user is presented with a default option that has already been selected for them, in order to influence their decision-making. Forced action ›The user wants to do something, but they are required to do something else undesirable in return.Hard to cancel ›The user finds it easy to sign up or subscribe, but when they want to cancel they find it very hard. Visual interference ›The user expects to see information presented in a clear and predictable way on the page, but it is hidden, obscured or disguised.Obstruction ›The user is faced with barriers or hurdles, making it hard for them to complete their task or access information.Nagging ›The user tries to do something, but they are persistently interrupted by requests to do something else that may not be in their best interests. Disguised ads ›The user mistakenly believes they are clicking on an interface element or native content, but it's actually a disguised advertisment. Trick wording ›The user is misled into taking an action, due to the presentation of confusing or misleading language.

Related enforcement

Belgian DPA (APD/GBA) 4
Belgian DPA's Investigation against Toerisme Vlaanderen ›Reprimand issuedExecutive-committee of the Belgian DPA (GBA) v. Rossel & Cie ›€50,000 in finesExecutive-committee of the Belgian DPA (GBA) v. Roularta Media Group ›€50.000 in finesInspection by GBA - X - 'Y' website ›€ 15.000 in fines
Danish DPA (DT) 4
Alstrøm - Din Isenkræmmer ApS’s Investigation by Danish Data Protection Authority ›Implementing a new consent based solution.Anonymous (complainant) v. DGU Erhverv A / S ›Redesigning consent mechanismDen Blå Avis' Ex Officio Investigation by Danish DPA ›No fineJP/Politikens Hus A/S Investigation by Danish DPA ›Reprimand issued
French DPA (CNIL) 4
Deliberation of the Restricted Committee concerning Apple Distribution International ›€8,000,000 in finesDeliberation of the Restricted Committee concerning Facebook Ireland Limited ›€60,000,000 in finesDeliberation of the Restricted Committee concerning Microsoft Ireland Operations Limited ›€60,000,000 in finesNGO la Quadrature du Net (LQDN) and Noyb (Complainant) v. Google LLC ›€50,000,000 in fines
UK DPA (ICO) 3
Colour Car Sales Limited's Investigation by UK DPA ›€198,000 in finesICO v. Emailmovers Limited ›3 months to complyWe Buy Any Car Limited Investigation by Information Commissioner’s Office ›€234,000 in fines
Court of Justice of the EU (CJEU) 2
Autoritatea Naţională de Supraveghere a Prelucrării Datelor cu Caracter Personal v. Orange România SA ›Response to request for a preliminary rulingPlanet 49 vs ECJ ›Undisclosed fines
D.AAA (claimant) v. Banco Bilbao Vizcaya Argentaria, SA ›€5 million in fines