D.A.A.A (Data Subject) v. Canary Click Consulting website

€8,000 in fines


Canary Click Consulting website was held liable for failure to provide information about the storage or deletion of their data and for not providing an option to reject cookies.

Our analysis

Canary Click Consulting received complaints from 10 individuals who alleged that the company promised to provide official certificates for a fee but only provided instructions on how to obtain them after the individuals entered personal data and paid the fee. Additionally, the company failed to provide information about the storage or deletion of personal data once a refund was requested. The AEPD investigated the matter and found that URL 1's privacy policy stated that personal data would only be used for "strictly necessary purposes" but also allowed for marketing purposes without an option for users to reject cookies. URLs 2, 3, and 4 did not have a cookie banner or a mechanism for users to reject cookies. Instead, users were directed to "configure the browser on their terminal equipment" to delete cookies. The dispute was whether URLs 1-4 were in violation of the GDPR. The AEPD held that Canary Click Consulting breached European and Spanish data protection laws. URL 1 breached Article 7 of the GDPR because users had to give their consent "generically" for all processing purposes, without the ability to withdraw consent for specific purposes like marketing. As a result, the AEPD issued a warning to Canary Click Consulting and ordered them to bring URL 1 and their privacy policy in line with Article 6(1)(a) of the GDPR within a month.


Canary Click was fined €8,000 by the AEPD for violating Article 22(2) of the Law 34/2002 (LSSI), which implements the e-Privacy Directive in Spain. The AEPD concluded that URLs 1-4 breached this article, and the company was fined €2,000 for each URL.


D.A.A.A (Data Subject) and Canary Click Consulting website

Case number


Related deceptive patterns

Related laws

Legal enforcement database by Leiser, Santos and Doshi

The information about laws and cases on this website is brought to you by the Leiser, Santos and Doshi enforcement database.

About us