For processing on a public marketing website, the only privacy notice is a PDF placed behind an account login wall. What accessibility problem does that create under Article 12?
Select an answer to reveal the explanation.
Short Explanation
If the public can be tracked on the site, the public should reach the notice without creating an account first. Easy access is the rule—burying the PDF behind a login fails that test.
Full Explanation
Article 12 requires information to be easily accessible. For processing on a public marketing website, placing the only privacy notice in a PDF behind an account login wall makes the information inaccessible to the very visitors whose data the site collects through cookies, forms, analytics beacons, or newsletter fields. People encountering a civic campaign site or a commercial landing page should be able to open the notice from the footer or an equally obvious control without first creating credentials. Accessibility here is practical: if the only copy sits behind authentication, pre-account collection is unexplained to the public audience.
PDFs are not categorically banned as a format; the defect is the login barrier for public-site processing, not the file type. Public websites are inside GDPR whenever they process personal data, so “public web is out of scope” is false. Login walls also do not satisfy transparency by proving identity first—they often obstruct notice for anonymous or pre-registration visitors who are already being tracked or whose form data are taken.
Exam caveat: authenticated account centres may host additional profile-specific privacy details, but that does not excuse missing public-area notice for public-area collection. Article 12 also covers intelligibility and disability-related access, not only whether a URL exists somewhere after signup.
Operational check: open the marketing site in a clean browser with no credentials, confirm the privacy notice loads in one or two clicks, ensure cookie and consent interfaces link to readable information, publish a stable public URL for the notice, and retire login-only placement as the sole disclosure channel.