A mobile app lets users consent to personalised ads with one tap at signup, but burying consent withdrawal five menus deep. What GDPR consent rule does this practice violate?
Select an answer to reveal the explanation.
Short Explanation
If saying yes is one tap, saying no should not be a scavenger hunt. Consent is only healthy when walking away is just as simple as signing up. Burying withdrawal five menus deep breaks that deal.
Full Explanation
Consent rules require that withdrawal be as easy as giving consent. A mobile app that collects personalised-ads consent with one tap at signup but buries withdrawal five menus deep creates an asymmetric burden that undermines freeness and the withdrawal standard. The compliance problem is not that mobile consent is impossible; it is that withdrawal is deliberately harder than opt-in, turning a clear yes into a scavenger hunt for no.
Consent may of course be collected on mobile devices when other validity conditions are met—freely given, specific, informed, and unambiguous. Withdrawal need not be filed with a supervisory authority within seventy-two hours as a precondition of stopping processing; the controller must honour withdrawal directly. Consent for ads is not valid only if given by postal mail; electronic affirmative acts can suffice when clear and informed.
Exam caveat: equal ease of withdrawal is a favourite CIPP/E pressure-test for consent UX dark patterns. Operational check: place withdraw controls at comparable prominence to the original opt-in, ensure they technically stop the ads processing and related sharing, and test the path on real devices and OS versions. City and public-service apps should model respectful permissioning—easy yes must mean easy no—so residents do not feel trapped by interface design, and product owners should record why a buried withdrawal path was rejected as incompatible with civic trust.