Just one day before publication, on December 12, 2024, privacy advocacy group noyb filed a formal complaint with the French data protection authority (CNIL) against social media platform BeReal, alleging the company employs manipulative design tactics to pressure users into accepting personal data tracking.
According to the complaint documents submitted by noyb, BeReal implemented a new consent system in July 2024 that presents users with what appears to be a straightforward choice between accepting or rejecting data tracking. However, the system remembers a user's acceptance indefinitely while requiring those who decline to face the same popup message every single day when attempting to post their daily photo.
"BeReal's nudging tactics are particularly absurd," states Lisa Steinfeld, Data Protection Lawyer at noyb. "When first confronted with the consent banner, users get the impression that the app actually respects their choice – only to find out that BeReal actually won't take no for an answer."
The timing of this complaint coincides with BeReal's recent push into advertising, as evidenced by the company's new advertising portal launched in late 2024. According to BeReal's own materials, the platform now claims 40 million active users across Europe, US, and Japan, with 70% of users falling between ages 18-27.
The technical details of BeReal's consent mechanism reveal a sophisticated system of data collection options. Users who select "Allow" are presented with multiple tracking categories, including device information storage, personalized advertising, performance measurement, and audience analysis. However, the complaint alleges that partially accepting only some tracking options results in the same daily popup pattern as fully declining.
The European Data Protection Board (EDPB) addressed similar consent tactics in their 2022 guidelines, noting that repeatedly prompting users for consent can lead to "consent fatigue" where users eventually give in simply to stop the recurring interruptions.
BeReal's core functionality requires users to take spontaneous photos within a two-minute window each day to see their friends' posts. According to noyb's filing, by tying the consent popup to this essential feature, BeReal creates significant pressure for users to accept tracking.
The complaint specifically alleges violations of multiple GDPR articles, including Article 4(11) regarding valid consent requirements, Article 7(3) on consent withdrawal rights, and Article 25 on privacy by design principles. Noyb has requested that CNIL order BeReal to modify its consent practices and delete personal data collected through these methods.
Statistics from BeReal's advertising materials indicate high user engagement, with 70% of daily active users posting content and 60% responding within the notification window. However, these engagement metrics also highlight the potential impact of tying tracking consent to core platform functionality.
The case represents a significant test of GDPR enforcement regarding dark patterns in user interface design. While previous regulatory actions have addressed cookie consent mechanisms on websites, this complaint specifically targets consent practices within a mobile application's core features.
This legal challenge emerges as BeReal begins monetizing its platform, requiring minimum advertising spends of $10,000 according to their new advertising portal. The complaint argues that this timing suggests the consent mechanism serves primarily commercial rather than technical necessities.