Ediscom Case: The Garante Sanctioned The Use Of Dark Patterns For The First Time

Thanks to Elena Mandarà for collaborating on this article

With a resolution issued on February 23, 2023, the Italian Data Protection Authority (Garante per la protezione dei dati personali, "Garante"), imposed an administrative fine on a company (Ediscom S.p.A., "Ediscom") for breaching several provisions of Regulation (UE) 679/2016 ("GDPR") while processing personal data for the purpose of carrying out marketing campaigns on behalf of its clients.

The resolution is particularly significant because for the first time the Garante stated that the use of dark patterns amounts to infringement of the GDPR.

As clarified by the Garante, since 2010 dark patterns have been seen from a consumer law perspective as a mechanism enabling negative influence on consumers' consent. More recently, it has been established that using dark patterns may also be in violation of the principles of data protection law.