Excerpt
ARANOW PACKAGING MACHINERY, S.L was fined by AEPD for violations related to its Cookie Policy. AEPD conducted an investigation that included an examination of the information provided in the Cookie Policy, including details on the use of cookies and data collected. AEPD also looked for any mechanism to reject all cookies, but found none.
Our analysis
A complaint was filed against the website ***URL.1 for not complying with data protection regulations, specifically for not having a Privacy Policy, a contact page, and a Cookie Policy in accordance with the current legislation. After examining the Privacy and Cookie policies, the AEPD found that the Privacy policy complied with Article 13 GDPR but the Cookie policy did not align with Article 22.2 LSSI. The website lacked a mechanism to reject all cookies, and there was no link to different browsers to deactivate or delete cookies, which was deemed contrary to legal provisions. Forced action deceptive design was used in this case by not providing users with an option to reject all cookies, which would require them to actively take steps to disable cookies individually in their browser settings. This design effectively forces users to accept cookies as the default option, even if they may not want them. This violates the principle of informed consent, as users are not provided with a genuine choice over whether or not to accept cookies.
Outcome
ARANOW PACKAGING MACHINERY, S.L was fined by AEPD for violating the rights of service recipients by using cookies without providing necessary information as per Article 22.2 of the LSSI. The company was fined EUR 3000 but used two attenuating factors from the LPACAP to reduce the penalty, resulting in a reduced fine of EUR 1800.
Parties
Mr. A.A.A. and Aranow Packaging Machinery
Case number
PS/00100/2020
Decision
Related deceptive patterns
Forced action involves a provider offering users something they want - but requiring them to do something in return. It may be combined with other deceptive patterns like sneaking (so users don't notice it happening) or trick wording (to make the action seem more desirable than it is). Sometimes an optional action is presented as a forced action, through the use of visual interference or trick wording. In cookie consent interfaces, forced action is sometimes carried out through "bundled consent". This involves combining multiple agreements into a single action, and making it hard or impossible for a user to selectively grant consent.
Related laws
Controllers must provide identity, contact details, processing purposes and legal basis, recipient information, retention period, and data subject rights when collecting personal data.
Requires informed consent for the use of data storage and retrieval devices, unless they are strictly necessary for service provision, and mandates clear information provision for such use.