Borchgrevink flagged Elkjop's practice to the company in 2020, arguing that conditioning loyalty program enrollment on accepting marketing communications fails GDPR Article 7(4)'s 'freely given' standard. Five years later, Datatilsynet validated his analysis with a NOK 20M fine, vindicating his original legal interpretation.
By submitting the story to HN where it drew 414 points, the submitter amplifies the framing that bundled consent is unambiguously unlawful under settled European data protection precedent — consistent with CNIL's Google/Facebook fines and the EDPB's 2024 'consent or pay' opinion.
The blog's framing centers the timeline as the scandal: he reported the violation in 2020 and was ignored for half a decade before regulators acted. This delay let Elkjop continue collecting marketing consent from millions of customers under what was ultimately ruled an unlawful flow, suggesting that the threat of GDPR fines means little when enforcement takes this long.
The editorial argues this isn't a niche Norwegian story because the same loyalty-program patterns ship across Elgiganten (Sweden/Denmark) and Gigantti (Finland), all under UK-listed Currys plc. Datatilsynet's decision gives the Swedish IMY and Danish Datatilsynet a clean reference case to act on without redoing the legal analysis, effectively multiplying the enforcement impact across the Nordics.
The Norwegian Data Protection Authority (Datatilsynet) has fined Elkjop, the Nordics' largest consumer electronics chain, NOK 20 million (~€1.8M) for violating GDPR Article 7(4) — the rule that consent isn't freely given when a service is conditioned on it. The flow in question: to join Elkjop's loyalty program (which gates extended warranty handling, receipt lookup, and discounts), customers had to accept marketing communications. There was no separate, equally-prominent path to enroll without saying yes to ads.
The story's hook is the timeline. Privacy researcher Jonas Borchgrevink (the 'That Privacy Guy' blog) says he flagged the practice to Elkjop in 2020, told them the bundling was unlawful, and was ignored. Five years later, the regulator agreed and put a price on it. Datatilsynet's decision specifically calls out the conditioning of loyalty membership on marketing acceptance as a textbook violation of the 'freely given' standard codified in GDPR Article 4(11) and Article 7(4), and reinforced by EDPB Guidelines 05/2020 on consent.
Elkjop is part of the Nordic Elkjop Group, which is itself part of UK-listed Currys plc — so this isn't a niche regional story. The same loyalty-program patterns ship across the group's brands (Elgiganten in Sweden and Denmark, Gigantti in Finland). The Norwegian decision establishes a clean reference case the Swedish IMY and Danish Datatilsynet can lean on without doing their own legal legwork.
Forced consent — also called 'consent walls' or 'take-it-or-leave-it consent' — is one of the most enforced GDPR patterns, and also one of the most common. The CNIL hit Google with €150M and Facebook with €60M in 2022 on a closely related theory (cookie banners that made 'accept' easier than 'reject'). The Austrian DPA ruled NOYB-style 'pay or okay' setups unlawful for news sites in 2023. The EDPB's April 2024 opinion on 'consent or pay' tightened the screws further. The pattern is settled law in the EU at this point: if the user has to say yes to marketing to get the underlying service, the yes doesn't count.
What makes the Elkjop case interesting for practitioners isn't the legal conclusion — that was predictable in 2020 — it's the enforcement physics. Five years. A complaint filed in 2020 produced an enforceable fine in 2025, by which point the PMs who shipped the flow, the lawyers who signed off on it, and probably the CISO who approved the data flows have all moved on. The org that pays is not the org that decided. This is the recurring structural problem with GDPR enforcement: the feedback loop is too long to influence the people writing the code.
There's also a math problem hiding in the fine itself. €1.8M against a group doing >€4B in annual revenue is rounding error. The deterrent isn't the cash — it's the *order to stop*, which forces a re-architecture of the signup flow, often with knock-on effects to CRM segmentation, attribution pipelines, and email warmup. The expensive part of a GDPR fine isn't the fine; it's the forced product change six weeks later when legal sends the 'we have 30 days to comply' memo and your loyalty signup conversion rate tanks 15%.
The community reaction on HN (414 points, ~300 comments) split into two camps that are both right. Camp A: 'good, dark patterns deserve enforcement.' Camp B: 'a five-year complaint cycle is not enforcement, it's theater — and the fine is too small to matter.' Both can be true. GDPR is shifting the equilibrium slowly. It's just not shifting it on the timescale of a product roadmap.
If you ship a loyalty program, newsletter signup, free tier, or any flow where a user gets *something* in exchange for an email, audit the consent capture today. The pattern that gets you in trouble is structural, not cosmetic: a single checkbox that grants both 'create my account' and 'send me marketing.' Splitting them into two checkboxes solves it. Pre-ticking the marketing one un-solves it. Making the 'no marketing' path require three more clicks than the 'yes marketing' path un-solves it again (that's the cookie-banner lesson the CNIL fined Google for).
The specific implementation pattern that holds up: account creation flow asks only for what's strictly necessary to deliver the service; a separate, post-signup prompt asks for marketing consent with equally-prominent yes/no options and no consequence to the underlying account if you decline. Store the consent record with timestamp, version of the policy text shown, and the specific UI variant — because when the regulator asks five years from now, your auth team will not remember which A/B test was live in week 17 of 2026.
For anyone building B2C in the EU, the operational implication is that 'marketing consent' is no longer a CRM problem — it's a data model problem. You need per-purpose consent (transactional vs. marketing vs. analytics vs. profiling) stored as first-class data, with a clean revocation path that propagates to every downstream system within the GDPR's required windows. If you're sitting on a single boolean 'opted_in' column, you're carrying the same liability Elkjop just paid for.
Expect the Swedish and Danish regulators to issue parallel decisions against Elgiganten/Gigantti within 12 months — the legal analysis is portable and the political incentive to act on a sister brand is high. Expect, also, more enforcement on adjacent patterns: free-tier SaaS that bundles marketing consent into signup, mobile apps that gate features behind 'personalized ads,' and the 'reject all cookies' button that's mysteriously 40 pixels smaller than 'accept all.' The five-year tail means the flows you ship in 2026 will be litigated in 2031. Build them assuming the regulator eventually wins, because in the EU, on this specific question, they do.
Actual decision (Norwegian): https://www.datatilsynet.no/contentassets/c8d0551d2a64403285...Machine translation of overview & 5.1 which is what the blog post is about (covers some other things as well): https://chatgpt.com/share/6a34732c-0fa4-83e8-aae1-95c
> The reply I received a few days later did me the favour of putting the violation on the record. Their position, in their own words, was that "in order to receive marketing / offers, it is a condition to be a member of the customer club." That one sentence is the whole case. They
There's also issue with EU companies forcing candidates to agree to their anti-privacy policies (confusingly named "privacy policies") as a requirement before the job interview.Those anti-privacy policies will state, that you grant the company and third-parties (so, anyone) permission
I understand where he's coming from, but it is still hilarious that he sued the legal entity that won the case for him, after they found the case in his favor.
Top 10 dev stories every morning at 8am UTC. AI-curated. Retro terminal HTML email.
I'm glad it all worked out for this individual. I hope more people live their lives like this as the dystopia progresses.Unfortunately, especially in the US, exercising your rights, or even just reading every paper you're expected to put your name to, not only constantly pisses people off