This summer, the popular Gen Z app BeReal, known for its candid selfie-sharing, made headlines when it was acquired by the French mobile gaming giant Voodoo. However, this acquisition has brought some unwanted attention as BeReal faces a privacy complaint in Europe over its revised approach to user consent for tracking.
The European privacy advocacy group, noyb, has lodged a complaint accusing BeReal of deploying “dark patterns”—tactics that subtly coerce users into consenting to ad tracking, which conflicts with the European Union’s General Data Protection Regulation (GDPR). According to the GDPR, consent must be given freely, without any strings attached, and these alleged methods contradict that standard.
Since July 2024, users in Europe have been encountering a consent banner on BeReal that appears to offer a straightforward choice between agreeing or refusing tracking. However, noyb’s complaint highlights a problematic aftermath for those who opt out of tracking. Users who decline are met with daily pop-ups every time they attempt to post, while those who concede never see the consent banner again. This recurring annoyance is perceived as a coercive attempt to push users towards giving in, thus questioning the validity of the consent being truly “freely given.”
Noyb’s stance is that BeReal’s strategy is a blatant use of dark patterns intending to manipulate users’ decisions. Their statement emphasizes that the app claims to respect choices but effectively disregards user rejections, putting undue pressure to consent. The organization draws attention to the guidance set by the European Data Protection Board in 2022. This guidance criticizes continuous consent prompts as it’s likely to wear down users into submission—a scenario noyb argues mirrors BeReal’s practices.
Lisa Steinfeld, a data protection lawyer at noyb, criticized BeReal’s tactics, noting that the user’s initial impression of choice quickly dissipates as the app seems to relentlessly push for consent. They argue this behavior blatantly defies the GDPR’s principle of free consent and trivializes user privacy rights in pursuit of data tracking.
The complaint has been filed with CNIL, the French data protection authority, where noyb has requested that they mandate changes to BeReal’s consent practices to align with GDPR requirements and remove any data collected through these questionable means. Additionally, they have called for a penalty against the company for its non-compliance.
As of now, Voodoo, BeReal’s parent company headquartered in France, has been reached out for their response to the allegations made in the complaint. The outcome of this case could set a significant precedent in how tech companies manage and respect user consent in Europe.
