Background. Online advertising companies heavily rely on tracking people’s browsing habits, their interests, interactions and whereabouts to show them personalised ads. However, according to EU privacy law, online tracking is illegal by default. Companies must therefore ask for your consent to “waive” your right to privacy if they want to follow you around. That’s why you see consent banners everywhere. The problem is, however, that most of these banners request your consent for hundreds, if not thousands, of online advertising companies that share your data among each other. While this is initially done for invasive online advertising, data is often also shared and sold by data brokers for other purposes. Even law enforcement agencies from both democratic and authoritarian governments buy such data for surveillance purposes.
Uninformed consent. dict.cc’s consent request currently mentions 1,741 “partner” companies that would be granted access to the device and the personal data of users. Reading all of their privacy policies would at least take 170 hours (even if you just scan each policy for 6 minutes). That is more than an entire week for one single consent request. In addition, these “partners” often say that they forward your data even further. For the complainant, as well as for other website users, this makes it practically impossible to understand the consequences of their “consent”. This common practice (see e.g. www.repubblica.it, www.bergfex.de, www.fifa.com) makes obtaining an “informed consent”, as required by the GDPR, essentially inconceivable.
Felix Mikolasch, data protection lawyer at noyb: “It would take days or even weeks to properly read and understand the data protection policies of 1,741 companies. It is ridiculous to assume that this would allow for an informed decision.”
Complaint filed in Austria. noyb has now filed a complaint with the Austrian Data Protection Authority, as dict.cc lacks a valid legal basis for processing the complainant’s data. We request the Austrian DPA to order the online dictionary to delete the unlawfully processed data – and to inform all recipients of the complainant’s data about the deletion. Furthermore, noyb is proposing that a fine be imposed to prevent similar breaches in the future. The Authority may also issue a wider ban or refer the matter to the European Data Protection Board for an opinion, given its general significance.
Martin Baumann, data protection lawyer at noyb: “Consenting to thousands of ‘partner’ companies using your personal data does not only feel wrong, it indeed is. The data protection authority must finally put an end to this practice.”