The French social media app BeReal promises its audience a daily dose of real life. Users are encouraged to “BeReal” by sharing daily selfies with their followers. To that end, every day at a random time, users receive a notification inviting them to „BeReal“ and take and post a photo of themselves within the next 2 minutes. Only then can users see what their friends have posted and interact with them.
BeReal aims at giving a real-life impression of peoples’ lives in contrast to other social media platforms, such as Facebook or Instagram, where every photo is carefully curated.
Now, the Vienna-based non-profit organization “NOYB- European Centre for Digital Rights” (noyb) has filed a complaint against BeReal on behalf of a user of the platform with the French data protection authority CNIL for using a deceptive model to induce consent by displaying an overly repeated pop-up to users when using the app, unless they accept all tracking.
How Real is BeReal about Consent?
As data protection savvy users will know, the use of tracking technologies requires the user’s consent, that is, if the operator of a platform wants to track our behavior, respectively analyze our interests and preferences, they may only do so if we were previously informed of this and have agreed to it voluntarily, usually by ticking the corresponding box in a cookie-banner.
When opening the BeReal app, users are now presented with a pop-up that provides them with the options to say “yes” or “no” to tracking their activities in the app in order to provide them with personalized experiences. So far, so good. Or not?
The issue with BeReal’s consent banner is that when you select “yes”, this choice is remembered and you won’t see the pop-up again, whereas, if you select “no”, the banner will pop-up again every day when you are prompted to take your photo of the day – until the annoyed user eventually consents. This is what the data subject, on whose behalf noyb filed the complaint, described.
Not only does the app not save your choice to not consent to tracking, but it apparently does not save your choice to consent only to certain tracking options, either: When checking “yes”, users are directed to the app’s privacy settings, where they can manually choose to consent to some of the tracking options and refuse others. This is what the complainant in this case did: After having frustratedly consented to tracking so as to no longer be presented with the pop-up every day, she then went to the privacy settings and opted out of some of the tracking options, only to find that she started receiving the pop-up again every day. This means, that a partial consent, respectively, withdrawal of consent, is not remembered by the app either. Only a full consent to all tracking options would prevent the banner from popping up again.
Dark Patterns
Techniques, where users are manipulated in their decision-making and nudged into giving their consent to tracking, are called dark patterns.
Nudging techniques are relatively wide-spread and have been the subject of fines, such as, for instance, in the case against a German meteorological service for having used a cookie-banner where an “X” in the upper corner would lead to “accept and close” (OLG Köln, Az. 6 U 80/23).
The European Data Protection Board (EDPB) has adopted Guidelines on deceptive design patterns in social media platform interfaces in February of 2023 which, inter alia, describe overloading as one such pattern, with continuous prompting being one of the techniques.
Let’s recall the prerequisites of consent according to the EU-GDPR: As per Article 4 para. 11 and Article 7 para. 3, consent must be given freely (without coercion), prior to the data processing, and based on an informed decision, plus, it may be revoked at any time. Withdrawing consent must be as easy as giving consent.
From noyb’s complaint, it seems that the tracking consent BeReal seeks to obtain from their users, does indeed lack voluntariness, in that users are driven into consenting, out of sheer annoyance to have to go through the privacy settings and say “no” every time before being able to use the core functionality of the app. A lack of valid consent would further mean that the processing of personal data for tracking purposes would be unlawful under European data protection law as it would lack a legal basis.
We are curious about the further development of noyb’s complaint and will keep you posted.