BeReal faces GDPR privacy complaint over alleged consent manipulation

The popular Gen Z app BeReal, renowned for its candid selfie-sharing format, is now under scrutiny in Europe following a privacy complaint related to how it secures user consent for tracking. The complaint, filed by the privacy advocacy group noyb, accuses BeReal of deploying manipulative design tactics, commonly referred to as “dark patterns,” to pressure users into accepting ad tracking. This raises concerns about compliance with the European Union’s General Data Protection Regulation (GDPR), which mandates that user consent must be freely given and uncoerced.

According to noyb, since its acquisition by French gaming company Voodoo in mid-2024, BeReal implemented a new consent interface for EU users. While the pop-up banner initially appears to offer a straightforward choice to either accept or refuse tracking, the experience for users who decline tracking is notably different. Users rejecting tracking are reportedly bombarded with daily reminders when they try to post on the app, whereas those who consent face no such interruptions. This daily nudge tactic, noyb argues, effectively punishes users for asserting their privacy rights, contravening GDPR guidelines on freely given consent.

Lisa Steinfeld, a data protection lawyer at noyb, criticized BeReal’s approach, stating: “The app gives the illusion of respecting user choice, but it blatantly pressures users into compliance by making their rejection burdensome.” To support their claim, noyb referenced guidance issued in 2022 by the European Data Protection Board, which explicitly warns against “continuous prompting” as a means of eroding user resistance.

The complaint has been submitted to CNIL, France’s data protection authority, urging it to investigate BeReal’s practices. It demands that the app adjust its consent mechanism to meet GDPR standards, delete any user data obtained through the alleged dark patterns, and face appropriate financial penalties. The stakes are significant: confirmed GDPR breaches can lead to fines of up to 4% of global annual turnover, a potentially hefty cost for BeReal and its parent company.

This legal challenge reflects a broader battle between tech platforms and regulators over how personal data is handled, especially in regions with stringent privacy laws like the EU. Whether BeReal adjusts its practices or doubles down on its controversial approach remains to be seen, but the outcome could set a precedent for app-based tracking mechanisms in the future.