He flagged forced consent in 2021. Five years later Norway fined Elkjop €1.8M
To stop marketing emails, Alexander Hanff had only one option: cancel his loyalty-club membership entirely. He told the retailer that bundling was unlawful in 2021. He found out he had won by reading a wiki, not from any regulator.
Elkjop's loyalty club made accepting marketing a condition of membership — no standalone opt-out. When Hanff complained, the retailer put it in writing: receiving offers 'is a condition to be a member of the customer club.' That one sentence became the whole case.
On June 1, 2026, Norway's Datatilsynet fined the Elkjop group NOK 20M (~€1.8M), ruling the consent forced, non-specific, and uninformed. Hanff — a 30-year privacy advisor who helped shape GDPR — learned of the ruling via the GDPRhub wiki, almost five years after filing.
The sentence that decided the case
The account (367 points in the thread) is by Alexander Hanff, a privacy specialist of 30 years who has advised the EDPB, the European Parliament and the Commission. His problem with Elkjop's loyalty club was simple: the only way to stop marketing was to cancel the membership altogether. There was no independent opt-out.
When he complained on July 30, 2021, the reply put the violation on the record. As one reader pulled the key line:
"Their position, in their own words, was that 'in order to receive marketing / offers, it is a condition to be a member of the customer club.' That one sentence is the whole case." — a reader quoting the retailer's written reply
Under GDPR, consent must be freely given and cannot be bundled with a service. Hanff's framing: "if you cannot say no without losing something you are entitled to keep, you have not freely consented to anything."
A €1.8M fine the complainant learned about from a wiki
The case crossed borders via the one-stop-shop mechanism: in September 2022 Sweden's IMY handed it to Norway's Datatilsynet. On June 1, 2026, Datatilsynet issued NOK 20 million (~€1.8M) against the Elkjop group, finding the consent forced, not specific, and the members not properly informed, citing Articles 4(11), 5, and 6. Nearly five years after filing, Hanff found out by reading the GDPRhub wiki, not from any regulator.
A Norwegian reader vouched for the agency's track record:
"Datatilsynet, the Norwegian DPA, from my experience, consistently has the user in mind. It (sadly) takes a long time… but they consistently come to good decisions." — a commenter describing direct experience with the agency
Another confirmed the pattern is common, not a one-off: a different big Norwegian company let him opt out of SMS or email, but not both, on pain of losing the membership.
"GDPR is theater": the dissent in the room
Not everyone cheered. The sharpest pushback questioned whether the law works as advertised:
"I wonder if anyone who are cheering this fine, actually read and tried to implement GDPR. It is a nightmare to be fully compliant for small companies. It is mostly just a theater…" — a skeptic on GDPR compliance cost
A second voice was darker still, arguing that people who actually exercise their rights pay a social cost the compliant never do, a disadvantage "as the dystopia progresses". Against that, US-based readers mostly registered envy: "I wish we had these rights in the USA".
The asterisk: a five-year fine no company will feel
The outcome reads as a clean win, but the thread keeps circling the timeline. The unanswered question was posed bluntly: how much did forced consent earn Elkjop over those five years? When a €1.8M penalty arrives half a decade after the complaint, discovered by accident on a wiki, the deterrent is weak by design. The rule GDPR encodes is unambiguous: bundling marketing into membership is unlawful. The enforcement, on this evidence, runs at a pace that lets the practice pay for itself first.
Get breakdowns like this every day
The top Hacker News stories, unpacked — by email, Telegram, or RSS.
Meta orders eight reactors that don't exist yet, delivery promised by 2032
TerraPower hasn't finished its first Natrium plant in Wyoming, but Meta just signed for up to eight more to feed its AI data centers. The thread's verdict: a 690 MW dual-site uptime number is being quoted for hardware nobody has switched on.