The use of location data, even if occasional and limited to identifying a store, constitutes intrusive processing that cannot be based on contractual necessity or legitimate interest when less privacy-intrusive alternatives exist; user consent is then required.

Facts and context

The Danish Data Protection Authority (Datatilsynet) issued a decision severely criticizing Coop Danmark A/S for breaches related to the use of customers' location data in its shopping app without an appropriate legal basis.

This case originated from a proactive audit conducted by the authority starting in July 2025, as part of its planned monitoring activities concerning the processing of personal data in shopping apps.

Reasons for the decision

• Obligation to have a legal basis for processing (Article 6 of the GDPR): The authority found that the use of location data for the "Scan and Pay" feature was unlawful. Coop Danmark A/S invoked contractual necessity (Article 6(1)(b)), arguing that location was essential to display correct prices and manage stock. The authority rejected this reasoning, considering that this processing was not strictly necessary, as less intrusive alternatives, such as scanning a QR code in-store (which the company also offered), could achieve the same goal. The intrusive nature of collecting location data therefore required obtaining user consent.
• Obligation to have a legal basis for marketing (Article 6 of the GDPR): The processing of location data for marketing purposes, based on the company's legitimate interest (Article 6(1)(f)), was also deemed unlawful. The authority considered that customers' interest in protecting their location data outweighed Coop's commercial interest in presenting targeted offers. It emphasized that less privacy-intrusive methods, such as manual selection of a store by the user in the app, were possible, making consent indispensable for such processing.
• Obligation to obtain valid consent (Article 4(11) of the GDPR): The authority criticized the consent collection mechanism for marketing cookies. The "Accept all" button was highlighted in red, while the "Accept selection" button was white. This design was considered to unduly influence the user's choice towards a blanket acceptance, undermining the free nature of consent required by the GDPR.

Authority's decision

Consequently, the authority issued a severe criticism against Coop Danmark A/S.

Furthermore, the authority ordered the company to provide a report on measures implemented to ensure compliance of its processing before 4 November 2026.

Lessons learned

This decision reminds that:

• The legal basis of necessity for the performance of a contract (Article 6(1)(b) of the GDPR) must be interpreted strictly; if a less privacy-intrusive alternative can achieve the intended purpose, the processing is not considered "necessary".
• The use of legitimate interest to process location data for marketing purposes is very risky, as the balance of interests generally favors the protection of the rights and freedoms of data subjects, requiring consent.
• The design of the consent interface must not steer the user's choice; using colors or contrasts to highlight the blanket acceptance button over other options can vitiate consent by undermining its freedom.