Precedent corpus / EDPB (European Data Protection Board)
European Data Protection Board
EDPB (European Data Protection Board) case GL-03-2022, decided . No monetary penalty.
We have not checked whether this decision was appealed. This is not a statement that no appeal exists.
No ConsentMark grade rests on this decision. It is published here because it is relevant enforcement, not because it bears on what a browser does before consent.
Regulator guidance (positive exemplar)
What the regulator decided
Interface design choices that "influence users in a way that infringes on the fairness, transparency or data-protection-by-design principles of the GDPR" constitute deceptive design patterns; the Guidelines identify six categories - overloading, skipping, stirring, obstructing, fickle, and left in the dark - and state that these patterns, where they steer users towards a specific decision contrary to their data protection interests, breach Articles 5(1)(a), 12, 13, 24 and 25 GDPR.
Primary source
Regulator-owned URL. Quote this in legal briefs and academic citations.
https://www.edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-032022-deceptive-design-patterns-social-media_enArchived snapshot
Wayback Machine snapshot of the primary source. Use this when the regulator URL might be refactored or expire.
https://web.archive.org/web/20240519080404/https://www.edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-032022-deceptive-design-patterns-social-media_enConsentMark interpretation
Operator-readable note on how this case shapes the ConsentMark scanner narrative. Not a legal opinion; cites the primary source.
Non-enforcement guideline. Cite when the scanner observes a deliberately-asymmetric consent UI - the EDPB has assigned these specific category names ("obstructing" for reject-behind-settings, "stirring" for emotional-colour nudging, "skipping" for default opt-in) so the narrative can name the pattern rather than paraphrase it. The EDPB Cookie Banner Taskforce Report 02/2023 cross-references this taxonomy when grading specific complaints.
Verification trail
Checked against the primary source on 26th May 2026. Next review 26th November 2026.
Cite this case
@misc{consentmark-precedent-edpb-gl-03-2022,
author = {{ConsentMark}},
year = {2023},
title = {EDPB (European Data Protection Board) GL-03-2022 - European Data Protection Board},
howpublished = {\url{https://www.consentmark.com/precedent/edpb-gl-03-2022}},
note = {ConsentMark methodology v7.8.1}
}ConsentMark. (2023, February 14). EDPB (European Data Protection Board) GL-03-2022 - European Data Protection Board. Methodology v7.8.1. https://www.consentmark.com/precedent/edpb-gl-03-2022[EDPB (European Data Protection Board) GL-03-2022 - European Data Protection Board - ConsentMark](https://www.consentmark.com/precedent/edpb-gl-03-2022)EDPB (European Data Protection Board) GL-03-2022 - European Data Protection Board - ConsentMark, 2023-02-14, methodology v7.8.1, https://www.consentmark.com/precedent/edpb-gl-03-2022