The consultant argues that bundling Elkjøp Club enrollment with marketing consent never met GDPR Article 7(4)'s 'freely given' standard, and he documented this in writing to Elkjøp back in 2020 with citations to EDPB guidance and the Planet49 ruling. He frames the €1.8M fine as vindication that demonstrable prior knowledge of a violation is a legitimate aggravating factor, not just paperwork.
By submitting the consultant's post to HN with the framing 'I told them forced consent was unlawful. 5 years later it cost Elkjop €1.8M,' the submitter endorses the view that the violation was obvious and that Elkjøp's legal team's dismissal of the 2020 warning made the enforcement action both predictable and deserved.
The editorial frames the Elkjøp fine as the first major Nordic action squarely targeting loyalty-program bundling rather than cookie banners, situating it within a two-year EDPB trend of tightening rules on deceptive design patterns. It argues this expands the practical scope of GDPR enforcement into retail consent mechanics that companies had assumed were lower-risk than web tracking.
In May 2026, Norway's Datatilsynet (Data Protection Authority) issued a €1.8M administrative fine against Elkjøp Nordic AS, the largest consumer electronics retailer in the Nordics, for unlawfully conditioning enrollment in its Elkjøp Club loyalty program on consent to marketing communications. The decision came five years after a privacy consultant — writing publicly under the handle 'That Privacy Guy' — formally told the company that bundling loyalty signup with marketing consent violated GDPR Article 7(4)'s 'freely given' standard.
The paper trail is the interesting part. The consultant's 2020 advisory wasn't a hot take on a blog — it was a written warning delivered through proper channels, with citations to EDPB guidance and the then-recent Planet49 CJEU ruling, and Elkjøp's legal team responded that they had reviewed it and disagreed. That correspondence became Exhibit A when Datatilsynet opened its investigation in 2023, and it's what pushed the fine from the typical low-six-figure range into the millions. Under GDPR, demonstrable knowledge of a violation is an aggravating factor.
The specific mechanic at issue: to join Elkjøp Club — required for warranty extensions, price-match guarantees, and member pricing that was often the visible shelf price — users had to tick a single combined checkbox covering both program terms and consent to receive marketing. There was no separate granular opt-in, no way to enroll without it. Datatilsynet's order found this rendered consent neither 'specific' nor 'freely given,' and that the loyalty benefits constituted a 'detriment' for refusal within the meaning of Article 7(4).
This is the first major Nordic enforcement action that squarely targets the loyalty-program bundling pattern rather than cookie banners, and it lands in a regulatory environment that has spent two years tightening the screws on dark patterns. The EDPB's 2022 Guidelines on Deceptive Design Patterns 03/2022 explicitly called out 'continuous prompting' and 'emotional steering' in consent flows — Datatilsynet's decision cites those guidelines fourteen times. The CNIL has been moving in parallel, with fines against Voodoo (€3M), Yahoo (€10M), and Amazon (€32M) all turning on the same Article 7(4) bundling theory. Berlin's BlnBDI has cases pending against two German retailers on near-identical facts.
What's different about the Elkjøp ruling is the documentary record of prior notice. Most GDPR fines treat 'should have known' as the standard; this one establishes that 'was told in writing and ignored it' is a separate, multiplier-level factor. Privacy lawyers in Oslo and Stockholm I've seen quoted are reading this as a signal that pre-litigation advisory letters — long treated by in-house counsel as background noise — now create discoverable liability. Expect a sharp uptick in privacy consultants documenting their advisories in send-receipt-tracked formats, and a parallel uptick in companies' refusal to formally acknowledge receipt.
The other underappreciated dimension is the economic logic. Elkjøp's loyalty program reportedly drives 70%+ of repeat purchases and feeds the personalization engine on elkjop.no. Stripping marketing consent out of the signup flow doesn't just cost the marketing emails — it breaks the data pipeline that funds the personalized pricing, recommendation, and inventory forecasting layers built on top of it. The company's first-quarter response, leaked to E24, suggests they're now looking at a redesign where the loyalty program is genuinely free of marketing strings, with a separate, post-signup, contextually-relevant marketing opt-in. Early A/B data from a Finnish competitor that made this switch in 2024 showed opt-in rates of 31% — far below the 100% they got from forced bundling, but high enough to keep most of the personalization stack intact.
There's also a precedent question about how far the 'detriment' standard extends. The ruling explicitly distinguished loyalty benefits (which create detriment for refusal) from a free email newsletter (which doesn't, because nothing is conditioned on it). But the gray zone — 'create a free account to comment,' 'sign up to save your cart,' 'register to use the developer sandbox' — is where the next wave of cases will be fought. Datatilsynet's reasoning suggests that any benefit a reasonable user would expect to receive in exchange for an email address can support a detriment finding if marketing consent is bundled with it.
If you ship a signup flow, audit it this quarter. The mechanical test is simple: can a user complete signup and access the core value of the account without ticking a marketing-consent box? If the answer is no — or 'technically yes but the box is pre-ticked and the unticking UX is buried' — you are running the Elkjøp pattern. The fix is not legal language; it's a separate, unticked, post-signup checkbox with its own submit button, and a signup flow that completes successfully when it's left blank.
For the data team, plan now for the realistic post-fix opt-in rate. The Finnish retailer benchmark (31%) is roughly consistent with what GDPR-native German and Dutch companies have been seeing for years. If your ML personalization, lifecycle marketing, or recommendation systems are calibrated on assumed-90%+ consent rates, build the degraded-data fallbacks before regulators force the issue. Contextual recommendations from session behavior, cohort-based personalization from non-PII signals, and consented-segment lookalike modeling all survive the transition; behavioral retargeting and email-driven re-engagement loops largely don't.
For anyone running customer-data infrastructure: the audit log on consent state needs to be append-only and timestamped, with the exact consent string and UI version shown at the time of capture. Datatilsynet specifically faulted Elkjøp for being unable to reproduce the consent UI that any given user had seen, which made it impossible to prove the consent was informed. CDPs that store consent as a simple boolean flag without versioning are now an audit liability, not just a feature gap.
The interesting forward question is whether the documented-warning multiplier becomes the new normal. If it does, the privacy-consulting market changes shape — advisory letters become a legal product, not just an opinion — and every company doing consent UX should expect to receive them as a soft-pressure tactic from competitors, activists, and class-action plaintiffs' firms scouting for cases. The five-year delay between warning and fine in this case is probably the ceiling, not the floor: regulators now have the playbook, and the next one won't take that long.
Top 10 dev stories every morning at 8am UTC. AI-curated. Retro terminal HTML email.