- On October 9, 2019, the Austrian data protection authority ruled that a double opt-in is mandatory for online dating registrations in accordance with Art. 32 GDPR.
- The platform allowed limited use without a confirmed double opt-in, with repeated prompts every 3 – 5 minutes.
- Unknown persons created profiles with the email of a minor; DPO found inadequate data security measures in accordance with Art. 32 GDPR
- The DPA did not conclusively clarify under which circumstances double opt-in is generally required (advertising vs. service/contract situation).
The Austrian Data Protection Authority (DPA) issued a decision on October 9, 2019 (DSB-D130.073/0008-DSB/2019) determined that according to Art. 32 DSGVO (data security) a double opt-in procedure is mandatory for registrations on an online dating platform.
Registration and limited use of the platform was possible without double opt-in:
It is correct that after registering and explicitly confirming their age and place of residence, and being asked to confirm their DoubleOptIn email, the User will have limited use of the Portal.
The request to confirm his DoubleOptIn email comes at regular intervals (every 3 – 5 minutes) within the portal as long as the user has not confirmed it.
In the present case, an unknown person had used the e‑mail address of the underage complainant to create two profiles on the online dating portals of the respondent, which constitutes unlawful data processing. Against this background, the DPO comes to the following conclusion:
By the fact that the respondent No sufficient data security measures corresponding to Art. 32 DSGVO it was possible that personal data of the complainant – namely the e‑mail address ***@***.com – were processed unlawfully, which violated the complainant’s fundamental right to confidentiality pursuant to Section 1 (1) of the Data Protection Act.
However, the DPA does not address the question of whether, why and under which circumstances a double opt-in procedure is mandatory according to the criteria of Art. 32(1) GDPR. It is also open whether a double opt-in procedure is also then required,
- if, unlike here, no advertising is sent without confirmation of registration, but only a service can be used; and
- if the registration is not considered consent, but is required, for example, in the context of a contract within the meaning of Art. 6 (1) lit. b DSGVO, e.g. in the case of an online purchase.
Cf. also the Contribution by Carlo Piltz to the decision.