He flagged forced consent in 2021. Five years later Norway fined Elkjop €1.8M (thatprivacyguy.com)
Elkjop's loyalty club made accepting marketing a condition of membership — no standalone opt-out. When Hanff complained, the retailer put it in writing: receiving offers 'is a condition to be a member of the customer club.' That one sentence became the whole case.
On June 1, 2026, Norway's Datatilsynet fined the Elkjop group NOK 20M (~€1.8M), ruling the consent forced, non-specific, and uninformed. Hanff — a 30-year privacy advisor who helped shape GDPR — learned of the ruling via the GDPRhub wiki, almost five years after filing.
Sign in to save