Regulating Bundled Consent in Digital Services

Abstract

Bundled consent is a common problem in digital services. Users are often asked to accept several data processing activities through one general consent button, including account registration, personalized recommendation, marketing, and third-party sharing. Although this form of consent appears lawful, it may weaken users’ real choice when necessary and non-essential processing are tied together. Based on the legal principles of informed consent, necessity, separate consent, and the right to withdraw consent, this paper examines how bundled consent should be regulated. It argues that the law should not focus only on whether users have clicked “agree,” but should also consider whether consent is voluntary, specific, separable, and easy to withdraw. Digital service providers should distinguish necessary authorization from optional authorization, provide clearer notices, and allow users to refuse non-essential processing without losing access to basic services.