Warning: Some posts on this platform may contain adult material intended for mature audiences only. Viewer discretion is advised. By clicking ‘Continue’, you confirm that you are 18 years or older and consent to viewing explicit content.
The thing to me is that under EU legislation, you need consent from a user to process their personal data.
If the user did not even know about it, then by definition, you did not get consent.
I (and judges) know that this is easier said than done. Even if you’re purely working in the interest of the user, you might not always succeed.
But it still means that the onus is on Microsoft here. They need to credibly ensure that they actually tried to get consent, for example this should be opt-in in the wizard, not opt-out.
The thing to me is that under EU legislation, you need consent from a user to process their personal data.
If the user did not even know about it, then by definition, you did not get consent.
I (and judges) know that this is easier said than done. Even if you’re purely working in the interest of the user, you might not always succeed.
But it still means that the onus is on Microsoft here. They need to credibly ensure that they actually tried to get consent, for example this should be opt-in in the wizard, not opt-out.