Right after BeReal got acquired by French mobile games publisher Voodoo this summer, the candid selfie-sharing app which has been popular with Gen Zers changed how it asks users to consent to tracking. The resulting pop-up is now the target of a privacy complaint in Europe. Confirmed breaches of the bloc’s General Data Protection Regulation (GDPR) can lead to penalties of up to 4% of global annual turnover.
European privacy rights non-profit noyb is behind the complaint, which accuses BeReal of using manipulative tactics (also called “dark patterns”) to try to pressure users into consenting to ad tracking — counter to the GDPR standard that consent should be “freely given.”
Since July 2024, noyb says that European BeReal users have been served with a consent banner that seems to offer a convenient accept/refuse choice to agree or deny tracking. However, its complaint addresses what happens after users interact with the banner — as it does not offer an equal experience, hence the contention that it’s unfair (and potentially unlawful).
BeReal deploys an aggressive “nudging tactic” to pester users who refuse its tracking, per noyb’s complaint. The banner reappears every day when they try to publish a post. Whereas users who agree to the tracking are left in peace without ever seeing the pop-up again.
“This is a prime example of a so-called dark pattern, designed to manipulate the users’ decision and annoy them into consent,” noyb argues in a press release detailing the complaint. “Overall, BeReal seems to be unable to take a ‘rejection’ when it comes to European’s right to privacy.”
In a statement, Lisa Steinfeld, a data protection lawyer at noyb, added: “BeReal’s nudging tactics are particularly absurd. When first confronted with the consent banner, users get the impression that the app actually respects their choice — only to find out that BeReal actually won’t take no for an answer. It is obvious that BeReal is trying to pressure users into consenting to tracking.”
To back up its assertion the tactic isn’t GDPR-compliant, noyb points to 2022 guidance on dark patterns in social media interfaces, penned by the European Data Protection Board, which warns against “continuous prompting” tactics that repeatedly ask users to consent — saying the dark pattern is likely to result in them “giving in as they are wearied from having to refuse the request each time they use the platform.”
“The GDPR makes it crystal clear that consent is only valid if it’s freely given,” added Steinfeld. “Unfortunately, BeReal doesn’t seem to care and would rather pressure people to give their consent even if they don’t want to be tracked.”
noyb has filed the complaint against BeReal with CNIL, the French data protection watchdog (the app’s parent, Voodoo, is based in France). It’s asking the regulator to order the app to fix the consent flow so it abides by the GDPR’s standard of a freely given choice and delete any data it’s processed since implementing the dark pattern. It also urges the CNIL to impose a fine.
Voodoo has been contacted for a response to the BeReal complaint.