1,741 “informed” consents with one click? GDPR complaint filed

一键点击即“知情”同意 1,741 次？GDPR 投诉已提交

Cookie Banners / 30 July 2026 Today, noyb has filed a complaint against the popular online dictionary dict.cc. The GDPR requires that consent is freely given, informed, specific and unambiguous. However, when visiting dict.cc, users are nudged into consenting to online tracking by a staggering 1,741 (!) “partners” with a single click. This makes it impossible for users to know exactly who has access to their data and how it is actually used. While dict.cc is an extreme example, requests to blindly waive your right to privacy for countless third parties is unfortunately a common issue with websites and apps relying on online advertising, even 8 years after the GDPR came into force.

Cookie Banners / 2026年7月30日，非营利组织 noyb 今日针对热门在线词典 dict.cc 提起投诉。根据《通用数据保护条例》（GDPR）规定，用户同意必须是自愿、知情、具体且明确的。然而，当用户访问 dict.cc 时，会被诱导通过一次点击，即同意多达 1,741 家“合作伙伴”进行在线追踪。这使得用户根本无法获知究竟是谁在访问他们的数据，以及这些数据是如何被实际使用的。虽然 dict.cc 是一个极端案例，但即便在 GDPR 生效 8 年后的今天，要求用户盲目放弃隐私权以换取无数第三方追踪，仍是依赖在线广告的网站和应用程序中普遍存在的问题。

Background. Online advertising companies heavily rely on tracking people’s browsing habits, their interests, interactions and whereabouts to show them personalised ads. However, according to EU privacy law, online tracking is illegal by default. Companies must therefore ask for your consent to “waive” your right to privacy if they want to follow you around. That’s why you see consent banners everywhere. The problem is, however, that most of these banners request your consent for hundreds, if not thousands, of online advertising companies that share your data among each other. While this is initially done for invasive online advertising, data is often also shared and sold by data brokers for other purposes. Even law enforcement agencies from both democratic and authoritarian governments buy such data for surveillance purposes.

背景：在线广告公司高度依赖追踪用户的浏览习惯、兴趣、互动和行踪，以便向他们展示个性化广告。然而，根据欧盟隐私法，在线追踪在默认情况下是非法的。因此，如果公司想要追踪用户，必须征得用户同意以“放弃”其隐私权。这就是为什么你到处都能看到同意横幅的原因。然而问题在于，大多数此类横幅要求用户同意数百甚至数千家在线广告公司获取数据，而这些公司之间还会共享数据。虽然这最初是为了进行侵入式在线广告投放，但数据往往也会被数据经纪人共享和出售，用于其他目的。甚至来自民主和威权政府的执法机构也会购买此类数据用于监控。

Uninformed consent. dict.cc’s consent request currently mentions 1,741 “partner” companies that would be granted access to the device and the personal data of users. Reading all of their privacy policies would at least take 170 hours (even if you just scan each policy for 6 minutes). That is more than an entire week for one single consent request. In addition, these “partners” often say that they forward your data even further. For the complainant, as well as for other website users, this makes it practically impossible to understand the consequences of their “consent”. This common practice (see e.g. www.repubblica.it, www.bergfex.de, www.fifa.com) makes obtaining an “informed consent”, as required by the GDPR, essentially inconceivable.

非知情同意：dict.cc 目前的同意请求中提到了 1,741 家“合作伙伴”公司，这些公司将被授予访问用户设备和个人数据的权限。阅读所有这些公司的隐私政策至少需要 170 小时（即使每份政策只浏览 6 分钟）。这意味着仅为了一个同意请求，就需要花费超过一周的时间。此外，这些“合作伙伴”通常声称他们会将数据进一步转发。对于投诉人以及其他网站用户而言，这使得他们实际上不可能理解其“同意”的后果。这种普遍的做法（参见 www.repubblica.it, www.bergfex.de, www.fifa.com 等）使得获取 GDPR 所要求的“知情同意”在本质上变得不可想象。

Felix Mikolasch, data protection lawyer at noyb: “It would take days or even weeks to properly read and understand the data protection policies of 1,741 companies. It is ridiculous to assume that this would allow for an informed decision.”

noyb 数据保护律师 Felix Mikolasch 表示：“阅读并理解 1,741 家公司的数据保护政策需要几天甚至几周的时间。认为这能让用户做出知情决定是荒谬的。”

Complaint filed in Austria. noyb has now filed a complaint with the Austrian Data Protection Authority, as dict.cc lacks a valid legal basis for processing the complainant’s data. We request the Austrian DPA to order the online dictionary to delete the unlawfully processed data – and to inform all recipients of the complainant’s data about the deletion. Furthermore, noyb is proposing that a fine be imposed to prevent similar breaches in the future. The Authority may also issue a wider ban or refer the matter to the European Data Protection Board for an opinion, given its general significance.

在奥地利提起投诉：noyb 现已向奥地利数据保护局提起投诉，因为 dict.cc 处理投诉人数据缺乏有效的法律依据。我们要求奥地利数据保护局责令该在线词典删除非法处理的数据，并通知所有接收过投诉人数据的接收方进行删除。此外，noyb 建议处以罚款，以防止未来发生类似违规行为。鉴于此事的普遍重要性，该机构也可能发布更广泛的禁令，或将此事提交给欧洲数据保护委员会征求意见。

Martin Baumann, data protection lawyer at noyb: “Consenting to thousands of ‘partner’ companies using your personal data does not only feel wrong, it indeed is. The data protection authority must finally put an end to this practice.”

noyb 数据保护律师 Martin Baumann 表示：“同意数千家‘合作伙伴’公司使用你的个人数据，这不仅感觉不对，而且确实是不对的。数据保护机构必须彻底终结这种做法。”