The new GDPR rules have barely been in effect for more than a few hours, but Google and Facebook are already being hit with a complaint for failing to comply with the regulation's requirements. According to privacy group noyb.eu, both companies are engaging in so-called "forced consent," which is the practice of bundling consent into an all-or-nothing package instead of the granular approach to consent required by the GDPR.
GDPR rules stipulate that companies may be fined up to the greater of €20 million or 4% of annual revenue, and that's precisely the amount the complaint is seeking. In fact, since the complaint also includes Instagram and WhatsApp, the amount noyb.eu is seeking is the somewhat disingenuous fine of €1.3 billion (≈ $1.5 billion) from each of Instagram, WhatsApp, and Facebook, coming in at a total of €3.9 billion, or $4.6 billion. In Google's case, the value of the penalty is up to €3.7 billion, or roughly $4.3 billion.
Under the new regulation, companies are prohibited from "bundling" consent requests and must provide a way for users to decide which permissions they wish to grant. However, common sense dictates that some permissions cannot be unbundled without making the service non-functional — users cannot honestly expect to be able to use Facebook if they consent to having their personal information collected but not stored. An argument can certainly be made that some kinds of consent are required for a product or service to be minimally functional and therefore cannot be unbundled.
It will be interesting to see how regulators handle this complaint. For one, Google and Facebook are arguably among the companies that have worked the most to be fully compliant with the GDPR. A harsh punishment for non-compliance — if the behavior is deemed to be non-compliant at all — might make other businesses decide that abiding by the rules of the GDPR are too steep a price to offer their services in the EU and may choose to drop out of the market altogether. On the other hand, not even half of all EU member states admit to being ready to start policing the regulation, so it may not even be entirely possible to handle the complaint for now.
We'll have to see how the case plays out, but it will be surprising if regulators end up asking for more than that either company unbundle their consent request, if at all.
- Fast Company