Pre-ticked bundled consent in a fitness app's insurance partnership
NordicFit AB runs a free fitness app with 480,000 users in the EU. At sign-up the app shows a single pre-ticked box: 'I accept the Terms of Service and Privacy Policy.' The privacy policy, about 4,000 words long, states that by accepting, users consent to sharing heart-rate, sleep and workout data with Solveig Insurance, which uses it to price premium discounts. Declining to tick closes the app; there is no version of the service without the data sharing. Users who want to withdraw consent must email the privacy team, and withdrawal 'takes effect within 30 days'. Since March, NordicFit has also sent a weekly newsletter to all users, including 90,000 people who registered before the current checkbox wording existed. The product lead says the newsletter is covered by legitimate interest; the DPO says the existing consent covers everything. A user has complained to the Swedish IMY. The company's consent records consist of a boolean flag and a timestamp, with no record of which wording was shown.
1. Is the consent a valid basis for sharing heart-rate and sleep data with Solveig Insurance? Assess each element of valid consent.
Read the worked answer
No. Consent must satisfy all of Article 4(11) and Article 7, and this design fails several elements at once.
- Freely given. Consent is not freely given where refusal has a clear detrimental effect. Here the only way to use the app is to accept the sharing, so users are effectively paying with health data. Article 7(4) requires that this condition be assessed, and Recital 43 says consent is presumed not freely given where the various purposes cannot be separated.
- Specific and granular. One tick covers terms of service, privacy policy and insurance sharing. Consent must be given separately for distinct purposes; bundling is exactly what Article 7(2) and Recital 32 discourage.
- Informed. The relevant purpose sits inside a 4,000-word policy rather than at the point of collection; the user is not told in a concise, intelligible way what happens to heart-rate data.
- Unambiguous indication of wishes. A pre-ticked box does not express active behaviour. CJEU case law (Planet49) is explicit that pre-ticked boxes are not valid consent.
- Special category data. Heart-rate and sleep data are health data under Article 9(1), so Article 9(2)(a) requires explicit consent, which is a higher standard still.
- Withdrawal. Article 7(3) requires withdrawal to be as easy as giving consent. A 30-day email process against a one-click sign-up fails that test.
The consequence is that the sharing with Solveig has no lawful basis and no Article 9 condition. Fines can reach EUR 20 million or 4% of worldwide turnover under Article 83(5). The fix is to untick, unbundle the insurance sharing into its own opt-in, offer the app without the sharing, and add one-step withdrawal.
2. Can NordicFit rely on legitimate interest for the weekly newsletter sent to all 480,000 users?
Read the worked answer
Not as things stand. Two legal regimes apply at once, and passing one does not satisfy the other.
Article 6 GDPR. Legitimate interest is available only if the processing is necessary and the balancing test is passed. Sending lifestyle marketing to consumers is a routine commercial interest, but the balance depends on reasonable expectations at the point of collection. For the 90,000 users who registered before the current checkbox, the data was collected under wording that did not cover newsletters, so their reasonable expectations are weaker for the company's case.
ePrivacy rules (implemented in Sweden through the Marketing Act). Electronic direct marketing to natural persons requires prior consent. The 'soft opt-in' exception only applies where contact details were obtained in the context of a sale, the marketing concerns similar products, and an opt-out was offered at collection and in every message. NordicFit obtained the data at sign-up to a free app, not in a sale, and offered no opt-out at collection.
Crucially, Article 95 GDPR means the ePrivacy rules apply in addition; a valid Article 6(1)(f) interest does not override a separate requirement for prior consent to email marketing.
Conclusion. Mailing should stop, or be reset through a compliant opt-in campaign that separates marketing consent from terms acceptance, logs the wording shown, and includes a working unsubscribe in each message. The 390,000 users who accepted the current wording are not covered either, because that consent was invalid and did not mention marketing.
3. What changes would bring NordicFit's consent and records into compliance, and what must the company be able to demonstrate?
Read the worked answer
A remediation programme, in order of legal risk:
- Change the collection design. Untick all boxes, separate the insurance data sharing from the terms, and offer the app without the sharing (for example a paid tier) so refusal carries no detriment.
- Add granular purposes. Health data sharing with an insurer, analytics and newsletter are three distinct consents, each with a plain-language explanation at the point of collection.
- Fix withdrawal. One in-app action, effective immediately, with the withdrawal communicated to Solveig.
- Refresh the population. The 480,000 existing users must be re-asked on the new design, or the sharing must stop for those who do not re-consent.
- Keep evidence. Article 7(1) puts the burden of proof on the controller: the company must show who consented, when, to which version of the wording, and how. A boolean plus timestamp is not enough; versioned consent records are required.
- Update the notice. Articles 12 to 14 information must be concise, transparent and free of charge, with the identity of the recipient, the purpose and the right to withdraw.
- Consider a DPIA. Sharing health data at scale with an insurer for pricing is likely to meet two or more of the EDPB's DPIA criteria (large scale, special category data, innovative use, data matching), so Article 35 should be assessed before any relaunch.
The IMY complaint should be answered on the basis of these steps, with a dated plan; the consent design itself is not defensible as it stands.