Contract trap · Privacy policy
Bundled consent, cookie wall
Acceptance of the ToS or оферта is defined to also constitute consent to marketing, profiling, sharing with third parties or cross-service data combination; the service or site cannot be used without that consent, or the only alternative to tracking is a paid subscription while the reject path is hidden or multi-click.
- Severity
- Serious
- How often it turns up
- Almost always
- Holds up?
- Often void
- Clause phrases
- 24
What it looks like in a contract
Redline matches these phrases against your document verbatim. Drafters rarely invent new wording — they copy it, which is why the same sentences turn up across unrelated contracts.
In English-language contracts
- by creating an account you agree to our Privacy Policy and consent to
- acceptance of these Terms constitutes consent to the processing
- as a condition of using the Service you consent
- if you do not agree you may not use the Service
- by registering you agree to receive marketing
- we may combine information across our services
- accept all cookies to continue
- to access this content, accept cookies or subscribe
- subscribe to use the service without personalised ads
- Manage options
- Legitimate interest
- Reject all
In Russian-language contracts
- Акцептуя оферту, Пользователь даёт согласие на обработку персональных данных
- Регистрируясь на сайте, Пользователь выражает согласие на получение рекламных сообщений
- Принятие условий Соглашения означает согласие на обработку
- Согласие на обработку персональных данных является неотъемлемой частью Договора
- Заключение договора возможно только при предоставлении согласия
- согласие на обработку является условием использования Сервиса
- отказ от предоставления согласия влечёт невозможность оказания услуг
- Для продолжения примите использование cookie
- Подписка без рекламы или согласие на персонализированную рекламу
- Принять все
- Настроить
- отказ от cookie ограничивает доступ
Check your own contract
Paste a clause, a page or the whole document. Nothing leaves your browser: the matching runs here, on this page, against the phrases above.
Why it bites
Consent to unnecessary processing is extracted as the price of the service, so 'consent' covers advertising, resale and profiling; withdrawing appears to mean losing the service; a data-protection right becomes a paywall — you fund the operator or surrender behavioural data.
Is it enforceable where you are
The same clause can be routine in one country and void in another. What follows is what the law says where you are — not advice on your particular contract.
In the EU and the UK, the GDPR governs the legal basis, the retention period and your right to erasure; in the US, state privacy laws (CCPA/CPRA and its successors) give an opt-out of sale and sharing.
United States
Generally enforceable; no freely-given-consent doctrine; FTC attacks it only when combined with deception or sensitive data (BetterHelp, Flo); CCPA prohibits discriminating against users who exercise opt-out rights but allows disclosed, proportional financial incentives.
- Cited
- CCPA
- FTC
European Union
GDPR Art 7(4) and Recital 43: consent bundled with a contract for unnecessary processing is presumed not freely given; Meta €390M (DPC, Jan 2023) rejected 'contract' as basis for behavioural ads; Grindr NOK 65M (2021); EDPB Opinion 08/2024: large platforms' consent-or-pay usually cannot produce valid consent; CNIL fined Google €150M and Facebook €60M (Jan 2022) because refusing cookies took more clicks than accepting; Commission DMA decision v. Meta €200M (Apr 2025); LG Berlin II 15 O 472/22 (2025) — Google's blanket account-creation consent unlawful.
- Cited
- GDPR Art 7(4)
United Kingdom
UK GDPR Art 7(4); CMA37 flags terms binding consumers to hidden or non-negotiable obligations; ICO (Nov 2023): rejecting must be as easy as accepting; ICO consent-or-pay guidance (2025) permits it only with a genuine, fairly priced choice.
- Cited
- CMA37
- GDPR Art 7(4)
- ICO
Russia
П. 4 ст. 16 ЗоЗПП (135-ФЗ, с 1 сент 2022): нельзя отказать в договоре за отказ предоставить ПД, кроме необходимых для исполнения; ст. 9 152-ФЗ: согласие конкретное и однозначное, с 1 сент 2025 оформляется отдельно от иных документов; РКН требует согласия на неосновные cookies; ст. 14.8 ч. 2 КоАП за ущемляющие условия, ч. 2.1 за навязывание (юрлица 200 000–500 000 ₽).
- Cited
- 135-ФЗ
- 152-ФЗ
- ст. 14.8 ч. 2 КоАП
- ст. 16 ЗоЗПП
- ст. 9
Where this has actually happened
Regulator actions, court rulings and the contracts they were fought over.
- Datatilsynet v. Grindr (2021, NOK 65M ≈ €6.5M; upheld on appeal 2025) — consent to the whole privacy statement did not cover sharing with ad partners
- DPC v. Meta (Jan 2023, €390M) — contract could not serve as legal basis for personalised advertising
- CNIL v. Google (€150M) and Facebook (€60M), 6 Jan 2022 — refusing cookies harder than accepting
- EDPB Opinion 08/2024 on 'consent or pay' (17 Apr 2024); European Commission DMA decision against Meta, April 2025 (€200M)
- vzbv v. Google Ireland, LG Berlin II 15 O 472/22 (25 March 2025) — blanket account-creation consent across 70+ services unlawful (on appeal)
- 135-ФЗ от 01.05.2022 amending ст. 16 ЗоЗПП — ban on refusing a contract because the consumer declined to provide personal data
What to do
In order, from the thing that takes a minute to the thing that takes a letter.
- Keep a copy of the exact clause and screenshot the banner asymmetry
- Use the reject path even if buried
- EU/UK/RU: consent bundled into the contract is presumed not freely given — withdraw it for non-essential purposes in writing while insisting the service continue, complain to the DPA/ICO citing EDPB Opinion 08/2024 and the CNIL 2022 decisions
- RU: cite п. 4 ст. 16 ЗоЗПП and ст. 9 152-ФЗ (separate consent) and complain to Роскомнадзор/Роспотребнадзор if service is refused.
Traps that travel with it
Drafters who use one of these usually use several.