Dark Patterns: the Spanish Data Protection Agency’s expansive sanctioning powers

On 20 September 2023, the Spanish Data Protection Agency (using its Spanish acronym, the “AEPD”) published an unprecedented resolution1 (the “Resolution”). This is a sanctioning procedure in which, for the first time, the AEPD punishes conduct related to the inclusion of dark patterns on the internet, thus linking this behaviour to the breach of the duty of information established in Article 13 of Regulation (EU) 2016/679 of 27 April on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the “GDPR”). The sanction amounts to €12,000 (of which €7,000 is imposed for the breach of the duty of information and €5,000 for the use of dark patterns).

Consult the full content of the Legal Briefing here.