I told them forced consent was unlawful. 5 years later it cost Elkjop €1.8M
Points and comments are a snapshot, not live.
A GDPR complaint over forced consent for marketing cost Elkjop €1.8 million after five years.
In 2021, a privacy expert complained to Elkjop that requiring membership cancellation to stop marketing violated GDPR. The Norwegian DPA fined Elkjop NOK 20 million (€1.8m) in 2026, finding consent was not freely given and repurposing data lacked a compatibility assessment. The complainant was not informed about the decision and is pursuing civil litigation.
The author warns that bundled consent models are widespread and unlawful, and criticizes oversight authorities for failing to keep them informed.
What commenters are saying
Commenters largely praised the outcome and EU privacy laws, with some noting similar experiences. Several pointed out that multiple US states now have privacy laws. The author noted the fine is just the first step, with a class-action-style claim pending and potential shareholder lawsuits. One user criticized the complainant as risky for businesses, drawing strong pushback. Others encouraged reporting violations, noting companies often fix issues when called out.