Team

Legal briefing

Dark Patterns: the Spanish Data Protection Agency’s expansive sanctioning powers

31/10/2023

The Legal Briefing analyses the Agency's first resolution in which a data controller is sanctioned for the use of dark patterns.

On 20 September 2023, the Spanish Data Protection Agency (using its Spanish acronym, the “AEPD”) published an unprecedented resolution1 (the “Resolution”). This is a sanctioning procedure in which, for the first time, the AEPD punishes conduct related to the inclusion of dark patterns on the internet, thus linking this behaviour to the breach of the duty of information established in Article 13 of Regulation (EU) 2016/679 of 27 April on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the “GDPR”). The sanction amounts to €12,000 (of which €7,000 is imposed for the breach of the duty of information and €5,000 for the use of dark patterns).

Consult the full content of the Legal Briefing here.

Related Practices and Sectors