Along with the dark patterns of “confirm my choices”, where my “choices” are an endless list of checkboxes hidden under expandable sections of complete gibberish.
Those dark patterns are not GDPR-compliant. GDPR says, "it should be as easy to say yes as it is to say know" and on top of that those huge lists do not present informed consent.
I think the preamble to the legislation sort of goes over it. I remember a section talking about marketing and it seemed to imply that businesses have a legitimate interest to market their own products to their own customers.
For example, a Dutch company might look at address data and see that they get a lot of orders online to ship to Germany and they can use that to open a store there. Obviously the business is interested in selling to its consumers effectively and obviously those consumers are interested in those products. When they start selling that information to other people, it isn't really legitimate anymore.
Until I read that, I held the belief that GDPR was really pretty clear and easy to implement. But reading that, it seems to me that the ICO doesn't really have a clue how you're supposed to distinguish a legitimate interest from an illegitimate one.
Perhaps the "legitimate interest" base needs to be deleted. It looks like a deliberate loophole.
