noyb heeft vandaag een GDPR-klacht ingediend tegen Kurier. Slechts een paar maanden geleden werden gebruikers gedwongen toestemming te geven voor Google en andere trackingcookies bij het bezoeken van de website van de Oostenrijkse krant. Hiermee overtrad het bedrijf duidelijk de GDPR, een feit dat ook werd bevestigd door de Oostenrijkse gegevensbeschermingsautoriteit: deze had het nieuwsmagazine Profil (dat deel uitmaakt van dezelfde mediagroep) al verboden om dergelijke gedwongen toestemming te gebruiken. Dit artikel gaat verder in het Engels.
Complaint with the Austrian data protection authority (1)
Previous complaint against Profil (2)
Forced consent. Only a few months ago, anyone who wanted to read an article on kurier.at without accepting a huge number of tracking cookies had an unsolvable problem: While consent was given with just one click, access to the website was denied if the well-hidden “Decline” option was selected. Users, such as the complainant at the beginning of March 2024, were forced to consent to tracking. Even the legally required option of easy withdrawal wasn’t implemented. The system has since been changed. Users now have the option to consent or signing up to a paid subscription (Pay or Okay).
Repeated violation of the law. This is not the first time the Austrian data protection authority (DSB) has been confronted with this violation. noyb has filed a complaint concerning an almost identical forced banner on profil.at in 2022. Back then, the DSB ordered the news magazine to adapt its website and obtain legally compliant consent. This never happened. Instead, the Kurier media group, to which both Profil and Kurier belong, decided to extend its practice to kurier.at and challenge the authority’s decision. There’s no final court judgement yet.
GDPR violations without consequence? Meanwhile, the Kurier media group has continued to force consent despite the DSB’s order. The data protection authority should therefore finally make use of its powers and impose an ‘effective, proportionate and dissuasive’ fine. If even the second breach of the GDPR remains without consequences, it could permanently weaken the position of the DPA.
(1) https://noyb.eu/sites/default/files/2024-06/Kurier_Beschwerde - Geschwaerzt.pdf
(2) https://noyb.eu/en/two-are-better-one-profilat-strikes-back-forced-banner-when-users-make-wrong-choice
